Merge remote-tracking branch 'origin/main' into wt/20261104-104444

serverAppConfigs-docs/Infrastructure/Authentik.md

@@ -145,18 +145,17 @@ relying-party quirks are reference lookup: [[Authentik Outpost Reference]].
 The second outpost — `dankclaw/authentik/quadlet/authentik-outpost-ldap.container`
 → `authentik-outpost-ldap.service`, one of the five units in this stack —
 serves LDAP for Jellyfin's LDAP-Auth plugin (`enabled`=generated, `active`
-`Restart=always`, container up, 2026-10-18). The image is pinned by its **amd64
-single-platform digest**
-`ghcr.io/goauthentik/ldap@sha256:2e7b259eb8c37faac916946ddf48ec681ee9d3a9f724fe8521bf161973f13cf9`
-(`dankclaw/authentik/quadlet/authentik-outpost-ldap.container:26`, matching the
-running image in `podman ps`, 2026-10-18). The digest in this page before 2026-10-18
-(`…fa33bc8f…`) is superseded. The reason for pinning a digest at all: podman
-5.7.0 refuses the plain tag because it resolves to a *nested* manifest list
-(index → per-platform manifest lists) — `unexpectedly received a manifest list
-instead of a manifest for a single image` — first hit on `:2026.8.0`, still the
-rule at the current `2026.8.3` pin. Resolve once with `podman manifest inspect
-<image> | jq -r '.manifests[] | select(.platform.architecture=="amd64") |
-.digest'` and pin that digest.
+`Restart=always`, container up, re-checked 2026-11-04). **The image pin has one
+owner: the `Image=` line of
+`dankclaw/authentik/quadlet/authentik-outpost-ldap.container`** — never restate
+the digest here, because every pin bump turns this page into a lie (the digest
+cited here went stale twice: `…fa33bc8f…`, then `…2e7b259e…`). The reason a
+digest is pinned at all: podman 5.7.0 refuses the plain tag because it resolves
+to a *nested* manifest list (index → per-platform manifest lists) —
+`unexpectedly received a manifest list instead of a manifest for a single image`
+— first hit on `:2026.8.0` and still the rule. Resolve once with
+`podman manifest inspect <image> | jq -r '.manifests[] |
+select(.platform.architecture=="amd64") | .digest'` and pin that digest.
 
 - Ports **389** (ldap) and **636** (ldaps) publish on the LAN
   (`PublishPort=389:3389`, `636:6636`